Loading malware…
VAMP is an Android spyware family associated with Palestinian cyber-espionage activity, most notably campaigns linked to Arid Viper, also known as Desert Falcon or APT-C-23. It has been used in targeted surveillance operations against individuals and organizations in the Middle East, including Palestinian targets, and has also appeared in broader multi-platform espionage activity alongside related Windows malware families. VAMP is part of a longer-running Android toolset that overlaps with other Arid Viper mobile malware families such as GnatSpy, FrozenCell, and later SpyC23 variants, indicating sustained development and code reuse across the actor’s mobile surveillance ecosystem.
VAMP is designed for data theft and device surveillance on infected Android phones. Reported capabilities include recording calls, stealing contacts, collecting messages, and exfiltrating documents stored on the device. Related reporting also notes functional similarities with later Arid Viper Android spyware components involved in audio capture and broader device monitoring. The malware has been described as a fully featured phone-resident surveillance implant intended to harvest sensitive personal and organizational information from mobile devices.
Distribution has relied primarily on social engineering and attacker-controlled Android application delivery. Campaigns associated with VAMP and related Arid Viper tooling used phishing-style lures, fake or convincing application themes, and third-party or attacker-operated sites rather than trusted app channels. In some operations, malicious Android applications were hosted on infrastructure made to resemble legitimate app distribution or topical services, consistent with targeted espionage tradecraft focused on persuading victims to sideload apps.
VAMP has been referenced both in activity attributed to Arid Viper and in reporting on Desert Falcons operations targeting Android users. Across these campaigns, the malware’s role is consistent with mobile espionage: covert collection of communications and locally stored data from Android devices belonging to politically relevant or otherwise high-value targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Android tooling used by Arid Viper shares many similarities with malware previously reported as FrozenCell and VAMP.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
The main changes from earlier research centered primarily around code obfuscation being added by those developing this malware.
Retrieve photos from the camera roll ... Retrieve contacts ... Retrieve text messages ... Search for and return the path of files with a doc or PDF extension
The analyzed Arid Viper Android malware contained the following functionality: • Take screenshots or record video
97 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as one of several malware signatures TuxBot attempts to kill on infected devices.
Older Arid Viper Android spyware family noted as sharing overlaps with newer SpyC23 variants.
Android spyware designed to steal data via call recording and theft of contacts and documents from the device.
Previously reported Android malware referenced as similar to Arid Viper's Android tooling.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.